Tunneling encapsulates one packet inside another so it can cross an intermediate network. The outer packet provides a virtual pathway; it does not create a separate physical route. In a site-to-site VPN, routers use this technique to connect sites across the internet. section 16.3.1 section 16.4
An IPsec tunnel processes traffic in this order:
- The local router receives a packet for a remote destination and encrypts the original packet, concealing its contents and intended destination. section 16.3.1
- The router encapsulates the encrypted packet with an IPsec header and a new outer IP header addressed to the remote router. section 16.3.1 section 16.4
- The remote router removes the outer encapsulation, decrypts the internal packet, and forwards it to the intended destination. section 16.3.1
A site-to-site VPN tunnel is a permanent virtual connection between two devices and remains until its configuration is removed. Hosts send ordinary traffic to their local router, which encrypts and transports it through the tunnel. IPsec supports unicast traffic; GRE supports broader traffic types, including broadcast and multicast, but does not encrypt. GRE over IPsec combines GRE encapsulation with IPsec protection. section 16.3.1 section 16.4
Figure 16.15 Tunneling an IP packet with IPsec. The IP packet is encrypted, encapsulated with an IPsec header and a new IP header, and then forwarded.
Shows the packet layers created when an IP packet is encrypted and encapsulated with IPsec and a new IP header. section 16.3.1
